CVE-2024-43441

CVE-2024-43441 is a critical (CVSS 9.8) authentication-bypass flaw (CWE-302, Authentication Bypass by Assumed-Immutable Data) in Apache HugeGraph-Server, where the server validates access based on request data it assumes cannot be modified. A remote attacker with network access can send specially crafted requests that tamper with this assumed-immutable data (such as credential/token material supplied in the request), slipping past the authentication layer of the server's API without any valid credentials. The flaw requires no privileges and no user interaction, and once past authentication the attacker gains the access of a legitimate user, with high impact on confidentiality, integrity, and availability of the graph data (CVSS C:H/I:H/A:H). All HugeGraph-Server deployments running version 1.0.0 or later but earlier than 1.5.0 are affected; the flaw is most consequential where authentication was deliberately enabled, since it renders that protection ineffective. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the EPSS score of 69.4% (99th percentile) indicates a high likelihood of exploitation within 30 days, so this should be treated as urgent to patch.

What to do: Upgrade Apache HugeGraph-Server to version 1.5.0, which fixes the issue. Until patched, do not rely on authentication to protect exposed instances: locate any HugeGraph-Server reachable from untrusted networks (REST/Gremlin API, by default on port 8080) and restrict access with firewall rules or a reverse proxy. Given the 69.4% EPSS score, review server logs for unexpected unauthenticated API access and watch for follow-on PoC or exploitation reports.